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Dear Mr. President: 

I am pleased to submit the Information Security Oversight Office's (ISOO) Report on Cost Estimates 
for Security Classification Activities for Fiscal Year 2011. 

This report provides information on the cost estimates of the security classification program as 
required by Executive Order 13526, "Classified National Security Information." It provides information 
concerning key components of the classification system from 41 executive branch agencies. It 
also contains cost estimates with respect to industrial security in the private sector as required by 
Executive Order 12829, as amended, "National Industrial Security Program." The cost estimates 
from the Central Intelligence Agency, the Defense Intelligence Agency, the Office of the Director 
of National Intelligence, the National Geospatial-Intelligence Agency, the National Reconnaissance 
Office, and the National Security Agency are compiled in a classified addendum to this report that is 
being transmitted separately. 

Sustaining and increasing investment in classification and security measures is both necessary to 
maintaining the classification system and fundamental to the principles of transparency, participation, 
and collaboration. As ISOO oversees the trends in executive branch operations, we will continue to 
focus on enhancing the policy and guidance directed towards maintaining an efficient and effective 
classification management program. 



JOHN P. FITZPATRICK 
Director 

Enclosure 

cc: Thomas Donilon 

Assistant to the President for National Security Affairs 



Respectfully, 




2011 REPORT TO THE PRESIDENT 

Cost Estimates for Security Classification Activities 



Background and Methodology 

The Information Security Oversight Office (ISOO) 
reports annually to the President on the estimated 
costs associated with agencies' implementation of 
Executive Order (E.O.) 13526, "Classified National 
Security Information," and E.O. 12829, as amended, 
"National Industrial Security Program." 

ISOO relies on the agencies to estimate the costs of 
the security classification system. Requiring agencies 
to provide exact responses to the cost collection 
efforts would be cost prohibitive. The collection 
methodology used in this report has consistently 
provided a good indication of the trends in total cost. 
It is important to note that even if reporting agencies 
had no security classification activity, many of their 
reported expenditures would continue in order to 
address other, overlapping security requirements, 
such as work force and facility protection, mission 
assurance operations and similar needs. 

The Government data presented in this report 
were collected by categories based on common 
definitions developed by an executive branch 
working group. The categories are defined below: 

Personnel Security: A series of interlocking and 
mutually supporting program elements that 
initially establish a Government or contractor 
employee's eligibility and ensure suitability for the 
continued access to classified information. 

Physical Security: That portion of security 
concerned with physical measures designed 
to safeguard and protect classified facilities 
and information, domestic, or foreign. 

Classification Management: The system of 
administrative policies and procedures for identifying, 
controlling, and protecting classified information from 
unauthorized disclosure, the protection of which is 
authorized by executive order or statute. Classification 
Management encompasses those resources used 



to identify, control, transfer, transmit, retrieve, 
inventory, archive, or destroy classified information. 

Declassification: The authorized change in the 
status of information from classified information 
to unclassified information. It encompasses those 
resources used to identify and process information 
subject to the automatic, systematic, and mandatory 
review programs established by E.O. 13526, as 
well as discretionary declassification activities and 
declassification activities required by statute. 

Protection and Maintenance for Classified Information 
Systems: An information system is a set of information 
resources organized for the collection, storage, 
processing, maintenance, use, sharing, dissemination, 
disposition, display, or transmission of information. 
Security of these systems involves the protection of 
information systems against unauthorized access to 
or modification of information, whether in storage, 
processing, or transit; and against the denial of 
service to authorized users, including those measures 
necessary to detect, document, and counter such 
threats. It can include, but is not limited to, the 
provision of all security features needed to provide 
an accredited system of computer hardware and 
software for protection of classified information, 
material, or processes in automated systems. 

Operations Security (OPSEC) and Technicai 
Surveillance Countermeasures (TSCM) 

OPSEC; Systematic and proven process by 
which potential adversaries can be denied 
information about capabilities and intentions 
by identifying, controlling, and protecting 
generally unclassified evidence of the planning 
and execution of sensitive activities. The 
process involves five steps: identification of 
critical information, analysis of threats, analysis 
of vulnerabilities, assessment of risks, and 
application of appropriate countermeasures. 

TSCM: Personnel and operating expenses 
associated with the development, training 
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and application of technical security 
countermeasures such as non-destructive and 
destructive searches, electromagnetic energy 
searches, and telephone system searches. 

Professional Education, Training, and Awareness: 

The establishment, maintenance, direction, support, 
and assessment of a security training and awareness 
program; the certification and approval of the 
training program; the development, management, 
and maintenance of training records; the training 
of personnel to perform tasks associated with 
their duties; and qualification and/or certification 
of personnel before assignment of security 
responsibilities related to classified information. 

Security Management, Oversight, and Planning: 

Development and implementation of plans, procedures, 
and actions to accomplish policy requirements, 
develop budget and resource requirements, oversee 
organizational activities, and respond to management 
requests related to classified information. 



Estimated costs associated with Physical Security 
were $1.74 billion, an increase of $305 million, 
or 21 percent. 

Estimated costs associated with Classification 
Management were $352.4 million, a decrease 
of $11.8 million, or 3 percent. 

Estimated costs associated with Declassification were 
$52.76 million, an increase of $2.3 million, or 5 percent. 

Estimated costs associated with Protection and 
Maintenance for Classified Information Systems were 
$5.65 billion, an increase of $953 million, or 20 percent. 

Estimated costs associated with OPSEC and TSCM were 
$128.97 million, an increase of $22.3 million, or 21 percent. 



Government Security Classification Costs 
FY2011 



Unique /ferns; Those department specific or agency 
specific activities that are not reported in any of the 
primary categories, but are nonetheless significant 
and need to be included. 

Survey Results and Interpretation 

The total security classification cost estimate within 
Government for Fiscal Year (FY) 2011 is $11.36 billion, 
an increase of $1.2 billion, or 12% from FY 2010. This 
figure represents estimates provided by 41 executive 
branch agencies, including the Department of Defense 
(DoD). It does not include the cost estimates of the 
Central Intelligence Agency, the Defense Intelligence 
Agency, the Office of the Director of National 
Intelligence, the National Geospatial-Intelligence 
Agency, the National Reconnaissance Office, and 
the National Security Agency. The cost estimates 
of these agencies are classified in accordance with 
Intelligence Community classification guidance and 
are included in a classified addendum to this report. 

For FY 2011, agencies reported $1.4 billion in 
estimated costs associated with Personnel Security, 
a decrease of $154.47 million, or 10 percent. 



Classification 
Management 
$352,397,989 

Professional Education, 
Training, and Awareness 
$502,507,085 



OPSEC & TSCM 
$128,969,440 



Declassification 

$52,763,862 



Unique Items 
$11,904,444 
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Personnel 

Security 


Physical 

Security 


Classification 

Management 


Declassification" 


Information 

Systems 


OPSEC & 
TSCM+ 


Training, & 
Awareness 


Oversight, & 
Planning 


Unique 

Items 


TOTAL 


1995 


$633 

million 


$175 

million 


$312 

million 


- 


$1,2 

billion 


- 


$67 

million 


$257 

million 


$6,4 

million 


$2,7 

billion 


1996 


$479 

million 


$308 

million 


$325 

million 


- 


$1,2 

billion 


- 


$72 

million 


$343 

million 


$5,6 

million 


$2,7 

billion 


1997 


$390 

million 


$345 

million 


$429 

million 


- 


$1,79 

billion 


- 


$78 

million 


$399 

million 


$4,2 

million 


$3,4 

billion 


1998 


$398 

million 


$386 

million 


$212,96 

million 


$199,65 

million 


$1,82 

billion 


- 


$93 

million 


$487 

million 


$5.7 

million 


$3,6 

billion 


1999 


$426 

million 


$410 

million 


$219 

million 


$233,18 

million 


$1,91 

billion 


- 


$97 

million 


$480 

million 


$0, 8 
million 


$3,77 

billion 


2000 


$426 

million 


$272 

million 


$212.75 

million 


$230.90 

million 


$2.55 

billion 


- 


$112 

million 


$439 

million 


$25 

million 


$4.27 

billion 


2001 


$859 

million 


$217 

million 


$221.30 

million 


$231.88 

million 


$2.50 

billion 


- 


$106 

million 


$539 

million 


$25 

million 


$4.7 

billion 


2002 


$941 

million 


$367 

million 


$236.97 

million 


$112.96 

million 


$3.12 

billion 


- 


$134 

million 


$742 

million 


$26 

million 


$5.68 

billion 


2003 


$950 


$536 


$264.66 


$53.77 


$3.66 


$15.01 


$158 


$858 


$27.7 


$6.52 


million 


million 


million 


million 


billion 


million 


million 


million 


million 


billion 


2004 


$941 


$691 


$323.87 


$48.26 


$3.90 


$12.22 


$178 


$1.15 


$6.4 


$7.25 


million 


million 


million 


million 


billion 


million 


million 


billion 


million 


billion 


2005 


$1.15 


$1.04 


$309.93 


$56.83 


$3.64 


$33.64 


$219 


$1.21 


$6.6 


$7.66 


billion 


billion 


million 


million 


billion 


million 


million 


billion 


million 


billion 


2006 


$1,11 


$1,06 


$312,90 


$43,99 


$4,02 


$88,42 


$237 


$1,36 


$7,3 


$8,24 


billion 


billion 


million 


million 


billion 


million 


million 


billion 


million 


billion 


2007 


$1,10 


$1,37 


$323,50 


$44,59 


$4,18 


$85,57 


$211 


$1,33 


$7,9 


$8,65 


billion 


billion 


million 


million 


billion 


million 


million 


billion 


million 


billion 


2008 


$1,10 


$1,29 


$333,71 


$42,73 


$4,34 


$90,15 


$243 


$1,20 


$8,8 


$8,65 


billion 


billion 


million 


million 


billion 


million 


million 


billion 


million 


billion 


2009 


$1,21 


$1,28 


$361,17 


$44,65 


$4,26 


$106,14 


$226 


$1,30 


$15,7 


$8,80 


billion 


billion 


million 


million 


billion 


million 


million 


billion 


million 


billion 


2010 


$1,56 


$1,43 


$364,22 


$50,44 


$4,69 


$106,65 


$400 


$1,54 


$21,9 


$10,16 


billion 


billion 


million 


million 


billion 


million 


million 


billion 


million 


billion 


2011 


$1,40 


$1,74 


$352,40 


$52,76 


$5,65 


$128,97 


$502,51 


$1,53 


$11,9 


$11,36 


billion 


billion 


million 


million 


billion 


million 


million 


billion 


million 


billion 



"Prior to 1998, Declassification costs were included in Classification Management costs. 
+Prior to 2003, OPSEC and TSCM costs were not reported. 
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Together, costs for Classification Management, 
Declassification, Protection and Maintenance for 
Classified Information Systems, and OPSEC and TSCM, 
make up the total cost for Information Security which is 
$6.18 billion, an increase of $965.85 million, or 19%. 

The FY 2011 estimated costs for Professional 
Education, Training, and Awareness were $502.51 
million, an increase of $102.1 million, or 25 percent. 

Estimated costs associated with Security Management, 
Oversight, and Planning were $1.53 billion, a decrease of 
$13.98 million, orl percent. 

Estimated costs associated with Unique Items were 
$11.9 million, a decrease of $10 million, or 46 percent. 

To fulfill the cost reporting requirements, a joint 
DoD and industry group developed a cost collection 
methodology for those costs associated with the use 
and protection of classified information within industry. 
For FY 2011, the Defense Security Service collected 
industry cost data and provided the estimate to ISOO. 



Cost estimate data are not provided by category 
because industry accounts for its costs differently 
than Government. Rather, a sampling method 
was applied that included volunteer companies 
from four different categories of facilities. The 
category of facility is based on the complexity of 
security requirements that a particular company 
must meet in order to hold and perform under a 
classified contract with a Government agency. 

The FY 2011 cost estimate totals for industry 
pertain to the twelve-month accounting period 
for the most recently completed fiscal year of the 
companies that were part of the industry sample 
under the National Industrial Security Program. 
The estimate of total security classification 
costs for FY 2011 within industry is $1.26 billion; 
an increase of $11.35 million, or 1 percent. 

This year's combined estimate for 
Government and industry was $12.62 billion, 
an increase of $1.2 billion, or 11 percent. 



Total Costs for Government and Industry FY 1995 - FY 2011 
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